1 // RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc -analyzer-store=region -analyzer-max-loop 4 -verify %s 2 #include "Inputs/system-header-simulator.h" 3 4 typedef __typeof(sizeof(int)) size_t; 5 void *malloc(size_t); 6 another_function(int * y)7static int another_function(int *y) { 8 if (*y > 0) 9 return *y; 10 return 0; 11 } 12 function_which_doesnt_give_up(int ** x)13static void function_which_doesnt_give_up(int **x) { 14 *x = 0; 15 } 16 function_which_gives_up(int * x)17static void function_which_gives_up(int *x) { 18 for (int i = 0; i < 5; ++i) 19 (*x)++; 20 } 21 function_which_gives_up_nested(int * x)22static void function_which_gives_up_nested(int *x) { 23 function_which_gives_up(x); 24 for (int i = 0; i < 5; ++i) 25 (*x)++; 26 } 27 function_which_doesnt_give_up_nested(int * x,int * y)28static void function_which_doesnt_give_up_nested(int *x, int *y) { 29 *y = another_function(x); 30 function_which_gives_up(x); 31 } 32 coverage1(int * x)33void coverage1(int *x) { 34 function_which_gives_up(x); 35 char *m = (char*)malloc(12); 36 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 37 coverage2(int * x)38void coverage2(int *x) { 39 if (x) { 40 function_which_gives_up(x); 41 char *m = (char*)malloc(12); 42 } 43 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 44 coverage3(int * x)45void coverage3(int *x) { 46 x++; 47 function_which_gives_up(x); 48 char *m = (char*)malloc(12); 49 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 50 coverage4(int * x)51void coverage4(int *x) { 52 *x += another_function(x); 53 function_which_gives_up(x); 54 char *m = (char*)malloc(12); 55 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 56 coverage5(int * x)57void coverage5(int *x) { 58 for (int i = 0; i<7; ++i) 59 function_which_gives_up(x); 60 // The root function gives up here. 61 char *m = (char*)malloc(12); // no-warning 62 } 63 coverage6(int * x)64void coverage6(int *x) { 65 for (int i = 0; i<3; ++i) { 66 function_which_gives_up(x); 67 } 68 char *m = (char*)malloc(12); 69 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 70 coverage7_inline(int * i)71int coverage7_inline(int *i) { 72 function_which_doesnt_give_up(&i); 73 return *i; // expected-warning {{Dereference}} 74 } 75 coverage8(int * x)76void coverage8(int *x) { 77 int y; 78 function_which_doesnt_give_up_nested(x, &y); 79 y = (*x)/y; // expected-warning {{Division by zero}} 80 char *m = (char*)malloc(12); 81 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 82 function_which_gives_up_settonull(int ** x)83void function_which_gives_up_settonull(int **x) { 84 *x = 0; 85 int y = 0; 86 for (int i = 0; i < 5; ++i) 87 y++; 88 } 89 coverage9(int * x)90void coverage9(int *x) { 91 int y = 5; 92 function_which_gives_up_settonull(&x); 93 y = (*x); // no warning 94 } 95 empty_function()96static void empty_function(){ 97 } use_empty_function(int x)98int use_empty_function(int x) { 99 x = 0; 100 empty_function(); 101 return 5/x; //expected-warning {{Division by zero}} 102 } 103